Privacy Policy

Updated 2026-10-19

The short version

• Your photo never reaches us. It is opened, cropped and saved inside your browser. No request sends it to us. If you open it from, or save it to, Google Drive or Dropbox, your browser exchanges it directly with that service.
• Visits are counted on our server, and the page reports only failures, both without cookies. A count holds only the page, the time, your country and the type of device, system and browser; a failure report only what failed, plus the format and size ranges when the size was the cause. Both are kept for three months, never contain your photo or its name, and your IP address is not stored.
• Do Not Track and Global Privacy Control are honoured. With either one on, the site sends no measurement at all.
• Advertising cookies need your consent where the law asks for it. The advertising section below explains how ads work when they run on CircleCrop.
• You can check it yourself. Open your browser's developer tools, go to the Network tab and crop and download a photo: no request carries it to us.

Who is responsible for your data

CircleCrop is run by one person. For the LGPD (Brazil), the GDPR (European Union and United Kingdom), the CCPA (California) and similar laws, the data controller is Guilherme Campos, in Brazil.

• Data protection requests: privacy@circlecrop.app
• Everything else: support@circlecrop.app

Under Resolução CD/ANPD nº 2/2022, CircleCrop is a small-scale processing agent and has not appointed a data protection officer (Encarregado). The controller named above answers you and the ANPD directly.

Your photo

Opened, cropped and saved in your browser

When you choose, take, drop or paste a photo, the page reads it on your device. Opening it, framing the circle, drawing the ring and the background, and making the final file all happen in your browser. Saving hands the file to your device or to the app you share it with. Your photo never reaches our servers, so there is nothing of yours for us to store, look at or delete. If you open it from, or save it to, Google Drive or Dropbox, your browser exchanges it directly with that service.

Opening a photo from a link

If you paste an image address, your browser downloads the image straight from that address, without your cookies for that site and without telling it which page asked. The site that hosts the image sees a normal request from your browser, as it would if you opened the address yourself, under its own privacy policy. CircleCrop does not receive the image or the address.

Temporary copies on your device

The home page and the editor are separate pages, so the photo is handed from one to the other through your browser's own storage (IndexedDB), on your device. The same storage holds the finished file and its name, so the home page can show it to you. These copies are used for one hour at most: after that the site ignores them and deletes them the next time it looks. A new photo replaces the previous one, and "New photo" deletes the finished file. Clearing this site's data in your browser removes them at once.

Your browser's session storage, which is emptied when you close the tab, keeps small notes that let the tool recover after a crash or a reload (for example, that a photo was being opened). It never holds the photo itself.

Google Drive and Dropbox

The Google Drive and Dropbox buttons are optional. Nothing from either service loads until you go to one of their buttons, or open More options on your result, where the save buttons are; then the page loads that service's own code from its own servers.

• Google Drive. You sign in in Google's window and allow CircleCrop thedrive.file permission. It covers only the files you choose in Google's file picker inside CircleCrop and the files CircleCrop saves for you; it does not let CircleCrop see the rest of your Drive. To open a photo, your browser downloads the file you chose straight from Google. To save, your browser uploads the finished image to your My Drive.
• Dropbox. To open a photo, you choose it in Dropbox's window; Dropbox gives your browser a link that works for four hours, and the file is downloaded at once. To save, you allow CircleCrop in Dropbox's window; it can only write into its own folder, Apps/CircleCrop. Dropbox then returns to a page on circlecrop.app that hands the permission to your open tab and closes.
• Access stays in your browser. Google and Dropbox give your browser a short-lived access key. It is kept only in the memory of the open page, is never sent to us or stored, and is gone when you close or reload the page.
• We receive none of it. No file, file name, account detail or access key from these services reaches us. The measurement learns about these services only when something fails: the failure report then names the step, the route or destination (Google Drive or Dropbox) and the image format.

CircleCrop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove CircleCrop's access at any time in your Google Account and in Dropbox's connected apps.

How the site measures its use

To know whether the tool works for people, and where it fails, CircleCrop measures in two ways and no more. No other analytics service is used. Both are written to Cloudflare's Workers Analytics Engine, in the operator's own Cloudflare account. Only the operator reads them. They are not shared, not sold and not used for advertising.

Visits, counted on our server

When a page of the site is requested, the Cloudflare Worker that serves it adds one to a count. The page runs no measurement code for this, and nothing is read from or stored on your device. A count holds: the page (the home page, the editor and the pages for keeping the whole photo and for adding a ring, each by name in every language of the site, or "other" for all remaining pages, never the part of the address after "?"), the time, your country, and the type of device, its system and its browser with its main version, read from your browser's identification string (User-Agent), which is then discarded. Cloudflare derives the country from your IP address; only the country code is written. There is no referring site, no cookie, no identifier and no stored IP address, so a count cannot be linked to you or to a later visit. Visits by robots are recognised and counted separately. Nothing is counted when Do Not Track or Global Privacy Control is on, nor for the speculative loads browsers make before you open a page (prefetch, prerender).

Failure reports, sent by the page

The page sends something only when a step you started fails or the photo is refused: choosing or opening a photo, making the file, saving it. A visit where nothing fails sends nothing from the page. If you close a dialog or deny a permission, that is your choice and it is not reported. A report holds at most:

• which step failed, and the reason, from a fixed list;
• how the photo came in, or how the file was to be saved (file picker, camera, drag and drop, paste, link, Google Drive, Dropbox; download, "save as", share, copy to clipboard);
• the photo's real format (input or output);
• a size range only when the photo was too large, a megapixel range only when it was too large or memory ran out, and the side range of the file that could not be made;
• for some failures, a technical error name or code (letters only, such as "NotReadableError"), and a time to failure only for timeouts;
• the page and the build version of the site.

Added by the Worker from the request of the report: the browser (family and main version), the system and the type of device, read from your browser's identification string (User-Agent), which is then discarded. No country is stored for failure reports.

Never in a report: the photo, its pixels, its file name, its exact size or dimensions, or its metadata (such as location or camera); web addresses, e-mail addresses and file paths; any identifier, cookie or entry in your browser's storage; memory, processor cores or screen density.

No cookies, no IP address stored

The measurement sets no cookie and keeps nothing in your browser's storage. There is no id for the tab or for a photo. For the visit counts our code does not read the IP address, not even as a key; Cloudflare derives the country from it and uses it to recognise robot networks, and it is not stored. For failure reports it is used only for the moment needed to limit floods of requests, and it is never stored. This data is not used for advertising.

When nothing is sent

With Do Not Track or Global Privacy Control turned on in your browser, no visit is counted and the page sends no failure reports; the server also discards any report that carries either signal. Browsers driven by automation send nothing from the page either. Ad and tracker blockers may also stop the reports, and that is fine with us.

How long, and on what legal basis

How long. Cloudflare keeps data written to Workers Analytics Engine for three months (Cloudflare's statement for this service, updated 23 April 2026: Analytics Engine limits). Our code sets no other period. After that the data is gone.

Access to your device (§ 25(2) no. 2 TDDDG; Art. 5(3) ePrivacy Directive). Sending a failure report needs no consent, because we treat it as strictly necessary to deliver the crop you asked for without errors. Our reasoning is written down and available on request. The visit count does not access your device.

Processing of what arrives. Where personal data is processed, the legal basis is our legitimate interest in keeping the tool working for the people who use it (GDPR art. 6(1)(f); LGPD art. 7, IX). The balancing of interests is written down and available on request.

Your right to object

You may object at any time to processing based on legitimate interest, on grounds relating to your particular situation (GDPR art. 21). There are two ways: turn on Do Not Track or Global Privacy Control in your browser (we treat both as an automated objection under GDPR art. 21(5)), or write to privacy@circlecrop.app.

Hosting by Cloudflare

The site is delivered by Cloudflare, which also protects it from abuse. Apart from advertising code when ads run, and the Google or Dropbox code that loads only when you go to their buttons or open More options, every file the pages use comes from circlecrop.app itself. Cloudflare may set strictly necessary cookies, such as __cf_bm, to tell people from bots; they are not used for advertising or to follow you. The list is in Cloudflare's cookie policy.

Preferences kept in your browser

If you choose the light or the dark theme in the menu, your choice is kept in your browser's local storage, under the name cc-theme, so the next visit opens the same way. Choosing "System" removes it. It never leaves your device. When a photo comes through the Browse button (your files, Google Drive or Dropbox), that place is kept the same way, under cc-source, so the Browse button opens it in one tap next time; and, for this tab only (session storage,cc-photo-source), where the current photo came from, so the result offers to save it back there. Neither holds a file or an account, and neither leaves your device.

Advertising

CircleCrop is free, and advertising is how it will pay for itself. When advertising runs on CircleCrop, the ads are served by Google AdSense, and the following applies.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
• You can opt out of personalized advertising in Google's Ads Settings, and opt out of other vendors' use of cookies for personalized advertising at aboutads.info.
• In the European Economic Area, the United Kingdom and Switzerland, Google's consent message asks for your choice before any advertising cookie is used, and you can change it later. If you say no, you may still see ads that are not personalized.
• In Brazil, the ANPD's 2022 guide on cookies treats advertising cookies as not strictly necessary, so the legal basis for them is your consent (LGPD art. 7, I).

How Google uses information from sites that show its ads is explained in Google's own page. Your photo is never part of any of this: advertising code runs beside the tool, and CircleCrop never passes the photo to it or to us.

Your rights

Depending on where you live, you have rights under the LGPD (art. 18), the GDPR (articles 15 to 22), the CCPA and similar laws:

• to know whether we process data about you, and to get a copy of it;
• to have it corrected, made anonymous, blocked or deleted;
• to move it to another service;
• to know who it was shared with;
• to object to processing based on legitimate interest, and to withdraw a consent you gave;
• in California, to know what is collected, to delete it, and to opt out of its sale or sharing. CircleCrop does not sell personal information.

To use any of them, write to privacy@circlecrop.app. CircleCrop has no accounts and keeps no identifier that outlives your tab, so in most cases the honest answer is that we hold nothing we can link to you; we will say so in writing. You can also complain to the ANPD in Brazil (gov.br/anpd) or to the data protection authority where you live.

Children

CircleCrop is a general-audience tool and is not directed at children. It asks no one for a name, an e-mail or an account, and it does not knowingly collect data about children. If you think a child's data reached us, write to the privacy address and we will delete it.

Transfers outside your country

The controller is in Brazil and our providers are in the United States, so your data is also processed there. Cloudflare runs data centers around the world, so a request may be answered, and the measurement data stored, outside your country, including in the United States. Where this is a transfer of personal data to a third country under the GDPR (art. 44 ff.), it is protected as follows (GDPR art. 13(1)(f)):

• Brazil (Guilherme Campos, the controller). The European Commission has adopted an adequacy decision for Brazil under GDPR art. 45: Implementing Decision (EU) 2026/179 of 26 January 2026. It covers controllers and processors in Brazil that are subject to Brazil's data protection law, the LGPD.
• Cloudflare, Inc. (United States; delivering the site and the measurement). Cloudflare is listed as an active participant in the EU-US Data Privacy Framework. Cloudflare's contract terms also provide for standard contractual clauses. More in Cloudflare's privacy policy.
• Google LLC (United States; only when advertising runs or you use Google Drive). Google is listed as an active participant in the EU-US Data Privacy Framework and names standard contractual clauses where they are needed. More in Google's privacy policy.
• Dropbox, Inc. (United States; only when you use Dropbox). Dropbox is listed as an active participant in the EU-US Data Privacy Framework and names standard contractual clauses among its tools. More in Dropbox's privacy policy.

The EU-US Data Privacy Framework rests on an adequacy decision of the European Commission of 10 July 2023 and is in force. The standard contractual clauses are the Commission's (Implementing Decision (EU) 2021/914). To learn more, see the European Commission's page on adequacy decisions and the Data Privacy Framework list.

Changes to this policy

When the way CircleCrop handles data changes, this page changes with it, and the "Updated" date shows when it last changed.

Updated 2026-10-19. Controller: Guilherme Campos, Brazil.